Harvesting SSH Credentials: Insights from My Honeypot Network

A researcher analyzed 30 days of SSH honeypot data across 15 globally distributed servers, capturing 1.5 million login attempts from 6,790 unique IP addresses using 131,922 distinct credential pairs. The attacks originated primarily from Asia (60% of IPs) and Europe (60% of login attempts), with China, the United States, and India being the top three attacking countries by unique IPs. The data reveals widespread automated credential harvesting campaigns, with European servers receiving the highest volume of attacks per IP address.